In addition to well-known provisions on business loan programs, paid leave and individual stimulus checks, the CARES Act included certain elements related to qualified retirement plans — 401(k), 403(b) and governmental 457(b) — such as allowing coronavirus-related distributions, changing rules related to participant loans and required minimum distributions, and allowing delays of pension contributions.
While these changes, and COVID-19 in general, have undoubtedly impacted plan sponsors and participants, one additional consideration is how the new rules impact employee benefit plan audits.
One major difference between past audits and those of today are they are now being almost completely performed in a remote environment. As such, the security of sensitive information passed from plan sponsor to auditor (and vice versa) has never been more important. Auditors should stay in close contact with plan sponsors and remind them to consider potential cybersecurity issues as sensitive participant information is retained by the plan sponsor as well as a service provider. Service provider SSAE16 reports should be reviewed by plan management to ensure proper security and internal controls are in place, and plan sponsors should review their security internally as it relates to the plan and discuss with the retirement plan committee.
Equally as important in a remote environment is the efficiency of audit testing and questions to the plan administrator. Plan sponsor resources available to dedicate to the plan audit may have changed, so the following should be considered:
- Priority of plan audit and timing;
- Errors in execution of plan provisions due to lack of resources and/or priority of time;
- Changes in eligible compensation due perhaps to furloughs and other events that may have happened during 2020, which could create errors in determining eligible compensation for purposes of employee deferrals and employer matching contributions;
- Timely deposits of employee contributions when there are gaps in employment of employees responsible for payroll; and
- Lack of formal corrections when errors are found.
With regard to changes to the benefit plans, auditors will need to look at several unusual items in light of the ongoing pandemic and resulting legislation. If distributions increased in 2020, auditors may be required to select larger samples for distribution and loan testing. Additionally, auditors will need to review any changes in internal controls as a result of decreased staff, if applicable, and ensure proper controls are still in place to protect the plan assets. Other new considerations may include:
- Partial plan terminations: The most recent stimulus package extended the determination period to March 31, 2021 for 2020. This will allow sponsors of defined contribution retirement plans to avoid the partial plan termination rules if the participant count as of March 31, 2021 is 80 percent of the active participant count at the time the national emergency was declared. Note that this is a general rule and there is also consideration of facts and circumstances.
- Plan amendments: Ensure formal amendments required by the CARES Act or due to the suspension or temporary suspension of employer contributions were completed by the end of 2020.
- Going concern: Consider the plan sponsor’s ability to continue as a going concern and ability to fund the plan.
- Fraud: While audits are not designed to detect fraud, there will be heightened scrutiny as desperate times sometimes call for desperate measures. Given these uncertain times, are there gaps in internal control that could allow money to be fraudulently taken from plan assets?
As audits are performed a year later, the impact of COVID-19 on employee benefit plan audits won’t be fully noticed until 2021 when Dec. 31, 2020 audits are being completed. Employees have always depended on plan sponsors and plan auditors to protect their retirement savings. The COVID-19 pandemic has made this even more important. Keeping current in the ever-changing circumstances will require plan sponsors and auditors to change how and when plan audits are performed. These changes will likely impact plan audits for years to come. With this new information in mind, auditors are up for the challenge.
